As Bermuda prepares for the full application of the Personal Information Protection Act 2016 on January 1, 2025, organisations that use personal information in Bermuda must keep in mind that Pipa protects the privacy rights of all individuals whose personal information is being used, regardless of their geographic location.

Although Pipa only applies to the use of personal information in Bermuda, Pipa makes no distinction about the residence, domicile, or geographic location of the individual – defined in Pipa only as “a natural person” – whose personal information (ie any information about an identified or identifiable individual) is being used.

The reality that individuals around the world, who have no other connection to Bermuda other than the fact that an organisation is using their personal information here, can assert their privacy right under Pipa carries some important implications for all organisations that collect and use personal information in Bermuda.

There are many ways in which personal information is collected for use from individuals who are outside of Bermuda. For example, international visitors to Bermuda may provide their personal information to their hotels, to a retailer, to vehicle rental agencies, or to various medical service providers here.

As well, personal information might be provided by persons who are outside of Bermuda to local financial institutions, such as banks or investment firms, to consulting, accounting and law firms, or to the individual’s employer whose head office is on-island.

A very common circumstance where sensitive personal information is collected occurs when insurance companies from around the world provide, in the ordinary course of business, comprehensive insurance claims information to their Bermuda reinsurer.

As a jurisdiction that relies heavily on international business, Bermuda’s anti-money laundering and antiterrorism financing duties associated with “know your customer” requirements results in a significant amount of personal information, which can be highly sensitive, to be collected and used by both the private and public sectors in Bermuda.

Of course, the operation of Pipa in this regard is neither exceptional nor unintended. Pipa was fundamentally designed to protect the privacy rights of individuals from around the world here in Bermuda.

The ability of individuals to hold organisations who use their personal information fully accountable under Pipa is what makes Bermuda, in the eyes of international privacy law, a “safe harbour” that allows such personal information to be legally exported for its use in Bermuda.

However, being an international safe harbour also means that any potential breaches of Pipa, and incidents of unauthorised access to, publication of, or use of personal information, may also attract the international attention and scrutiny by both foreign privacy regulators and by potentially many individuals around the world who may be adversely affected in those potential circumstances.

• Duncan Card is a partner at Appleby who specialises in IT and outsourcing contracts, privacy law and cybersecurity compliance in Bermuda. A copy of this column can be obtained on the Appleby website at www.applebyglobal.com. This column should not be used as a substitute for professional legal advice. Before proceeding with any matters discussed here, persons are advised to consult with a lawyer